[keycloak-user] Optional 2FA Delegate Authenticator

[Steve Favez]

Dear Keycloak community,

I'm trying to get the following functionality in my browser authentication
flow:

1. Like "OptionalOTP" I'd like to get, after user login authenticator, an
Option2FA (second authentication Factor) that will ask for a second factor
of authentication according to some predicates (client IP, time, user role,
...)
2. I need more than OTP as second factor. OTP is one good solution, but I
need to provide to the end user a set of 2FA, like SMS, MatrixCard and so
on.(can be configured). But I also need to leverage on existing
authenticator, so, my wish is to reuse existing or new Authenticator.

In that sense, I tried to create a skeleton implementation - and share it
through github,

I really need some input from the community, if it sounds correct or if you
have any better idea to implement such a use case.

see . https://github.com/stevefavez/keycloakext
class : ConditionalMultiFactorAuthenticatorDelegate

I look forward for your valuable feedback.
(By the way, I know that this feature should be implemented in the next
release, but I must implement it on 2.x, because we're using rh sso.)

Thanks in advance for your help.

Best regards

Steve